ASP.Net website receives a spike in requests that crash the IIS workflow

I am running a fairly large volume of asp.net website through two serving clusters. Typical server load is about 20 requests / second per server, recorded by the ASP.Net Apps performance object.

The performance counter records 2,000 to 9,000 requests / second periodically throughout the day. The worker process dies at this time and reports it in the application log ".Net Runtime 2.0 Error Reporting" with the message "Faulting application w3wp.exe".

The strange thing is that IIS is not registering a burst of requests at this time. Weblogs record the usual rate of traffic up to this point and do not show a surge in thousands of requests.

The server runs IIS6 on a 64-bit Windows 2003 server. It is a quad-core xeon processor with 6GB of RAM.

Only one of the two servers in the balanced cluster balance records this volume of requests. The other server never shows more than 20 or so average requests / seconds.

Any ideas as to why the performance log is showing such a large volume of requests that are not being logged anywhere? I am unable to determine what is causing this load and I am wondering if this is some kind of application bug or is it really a traffic spike.

Any suggestions for tracking down the culprit?

+2


source to share


3 answers


Get crashdump of your asp process with debugging tools (Windbg and Co).



Check out http://blogs.msdn.com/tess .

+2


source


After using WinDbg to view the crash dump, it turned out that it was caused by a recursive Server.Transfer generating a stack overflow.

Apparently the performance log that shows the request / section for ASP.Net v2.0.50727 applications records the server transfer as a new request. But since it doesn't do client redirection, it never shows up in the IIS logs, as a DOS attack probably might be.



The fact that the log was showing high requests / sec made me think it was not an application bug.

Thanks for all your suggestions.

+1


source


To be honest, this sounds like a potential DoS attack. Can you turn on the log on your router / switch to see how the processed ethernet frames go? Let me know. Thank.

-Shaun

0


source







All Articles